diff --git a/.gitignore b/.gitignore
index 08a2efc..1b068a3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
 *.db-journal
 .DS_Store
 .wt-pr37/
+docker-compose.override.yml
diff --git a/docker-compose.yml b/docker-compose.yml
index a923676..a7e7db9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -25,16 +25,19 @@ services:
       # Options: openrouter, openai, anthropic, ollama
       - PROVIDER=${PROVIDER:-openrouter}
       
+      # Allow public bind inside Docker (required for container networking)
+      - ZEROCLAW_ALLOW_PUBLIC_BIND=true
+      
       # Optional: Model override
       # - ZEROCLAW_MODEL=anthropic/claude-sonnet-4-20250514
       
     volumes:
-      # Persist workspace and config
-      - zeroclaw-data:/data
+      # Persist workspace and config (must match WORKDIR/HOME in Dockerfile)
+      - zeroclaw-data:/zeroclaw-data
       
     ports:
-      # Gateway API port
-      - "3000:3000"
+      # Gateway API port (override HOST_PORT if 3000 is taken)
+      - "${HOST_PORT:-3000}:3000"
     
     # Health check
     healthcheck:
diff --git a/src/config/schema.rs b/src/config/schema.rs
index f4d5ccd..2ec474b 100644
--- a/src/config/schema.rs
+++ b/src/config/schema.rs
@@ -1002,6 +1002,11 @@ impl Config {
             }
         }
 
+        // Allow public bind: ZEROCLAW_ALLOW_PUBLIC_BIND
+        if let Ok(val) = std::env::var("ZEROCLAW_ALLOW_PUBLIC_BIND") {
+            self.gateway.allow_public_bind = val == "1" || val.eq_ignore_ascii_case("true");
+        }
+
         // Temperature: ZEROCLAW_TEMPERATURE
         if let Ok(temp_str) = std::env::var("ZEROCLAW_TEMPERATURE") {
             if let Ok(temp) = temp_str.parse::<f64>() {
diff --git a/src/main.rs b/src/main.rs
index a3a3bd3..67350f2 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -327,7 +327,8 @@ async fn main() -> Result<()> {
     }
 
     // All other commands need config loaded first
-    let config = Config::load_or_init()?;
+    let mut config = Config::load_or_init()?;
+    config.apply_env_overrides();
 
     match cli.command {
         Commands::Onboard { .. } => unreachable!(),